Fault-Tolerant Pressure Relief System for Drilling

ABSTRACT

A fault-tolerant system relieves pressure of fluid flow in a drilling system. Redundant pressure relief valves can open to relieve fluid flow from a discharge outlet of a manifold when over pressurization is detected. A hydraulic arrangement operably connected to the redundant relief valves provides hydraulic motive force in redundant hydraulic circuits respectively to the redundant relief valves. The redundant circuits are cross-connected to one another. Pressure transducers distributed in the hydraulic arrangement measures operational pressures of the hydraulic arrangement. Redundant controllers can both control the hydraulic motive force provided in the redundant circuits respectively to the redundant relief valves to open and close the relief valves in response to the pressure level measurement.

BACKGROUND OF THE DISCLOSURE

Flow of formation fluids into a wellbore during drilling operations iscalled an influx or “kick.” By contrast, a fluid loss occurs whendrilling fluid in the wellbore is lost to the formation. Both can have anumber of detrimental effects. If a kick cannot be detected andcontrolled fast enough, it can escalate into an uncontrolled flow offormation fluids to the surface, which is called a “blow-out.”Consequences from a blow-out may vary from operational delays(non-productive time) to more severe damage to equipment.

Hydrostatic pressure is a first conventional barrier for controlling thewell from a “kick,” and blow out preventers (BOP) are a second barrier.In addition to these, other equipment and techniques can detect andhandle a kick during drilling operations to maintain proper hydrostaticpressure in the well.

For example, kick detection can be achieved by continuously monitoringthe return flow (i.e., flow-out) in a closed-loop circulation system andcomparing the flow-out to the flow-in to the closed-loop circulationsystem. Several controlled pressure drilling techniques have been usedto drill wellbores with such closed-loop drilling systems. In general,the controlled pressure drilling techniques include managed pressuredrilling (MPD), underbalanced drilling (UBD), and air drilling (AD)operations.

In the Managed Pressure Drilling (MPD) technique, for example, thedrilling system uses a closed and pressurizable mud-return system, arotating control device (RCD), and a choke manifold to control thewellbore pressure during drilling. The various MPD techniques used inthe industry allow operators to drill successfully in conditions whereconventional technology simply will not work by allowing operators tomanage the pressure and flow in a controlled fashion during drilling.

As the bit drills through a formation, for example, pores become exposedand opened. As a result, formation fluids (i.e., gas) from an influx orkick can mix with the drilling mud. The drilling system then pumps thisgas, drilling mud, and the formation cuttings back to the surface. Asthe gas rises up the borehole, the gas may expand, and hydrostaticpressure may decrease, meaning more gas from the formation may be ableto enter the wellbore. If the hydrostatic pressure is less than theformation pressure, then even more gas can enter the wellbore.

As a primary function, managed pressure drilling attempts to controlsuch kicks or influxes of fluid. This can be achieved using an automatedchoke response in the closed and pressurized circulating system madepossible by the rotating control device. A control system controls thechokes with an automated response by monitoring the flow-in and theflow-out of the well, and software algorithms in the control system seekto maintain a mass flow balance. If a deviation from mass balance isidentified, the control system initiates an automated choke responsethat changes the well's annular pressure profile and thereby changes thewellbore's equivalent mud weight. This automated capability of thecontrol system allows the system to perform dynamic well control orconstant bottom hole pressure (CBHP) techniques.

Even though pressure can be controlled during drilling operations usingsuch controlled pressure drilling techniques discussed above, componentsand processes are needed to relieve overpressure to either protect theformation or to prevent damage to drilling equipment. A typicaloverpressure configuration uses a pressure relief valve having a controlconsole that detects an overpressure condition and opens the pressurerelief valve to relieve the pressure.

For redundancy in a drilling system, the overpressure configurationsimply includes a first pressure relief valve having its control consoleand includes a second, separate pressure relief valve having its owncontrol console. In such an arrangement, limited protection can beachieved even though the configuration has some redundancy. Forinstance, a fault of one pressure relief valve would negate its use, butthe other pressure relief valve with its console could assumeoverpressure protection. In like manner, a fault of one console wouldnegate use of its pressure relief valve, but the other pressure reliefvalve with its console could assume overpressure protection. Yet, lossof rig power, loss of rig air supply, loss of sensor inputs, loss ofcommunications, or any other number of faults could negate use of bothpressure relief valves and/or consoles so overpressure protection wouldbe lost.

The subject matter of the present disclosure is directed to overcoming,or at least reducing the effects of, one or more of the problems setforth above.

SUMMARY OF THE DISCLOSURE

According to the present disclosure, an assembly is used for relievingpressure of fluid flow in a drilling system in response to a pressurelevel measurement of the drilling system. The assembly comprises:pressure relief valves, hydraulic circuits, and controllers.

The pressure relief valves are disposed in fluid communication betweenthe fluid flow and at least one discharge outlet. Each of the pressurerelief valves is operable to open and close fluid communication of thefluid flow with the at least one discharge outlet. The hydrauliccircuits are cross-connected to one another and are operably connectedto the pressure relief valves. The hydraulic circuits provide hydraulicmotive force respectively to the pressure relief valves.

The controllers are operably connected to the hydraulic circuits. Eachof the controllers receives the pressure level measurement of thedrilling system. Both of the controllers in a standard conditionsimultaneously control the hydraulic motive force provided in thehydraulic circuits respectively to the pressure relief valves toindependently open and close the respective pressure relief valve inresponse to the pressure level measurement. In response to a firstfailure condition of either one of the controllers, the other one of thecontrollers independently controls the hydraulic motive force providedin the hydraulic circuits respectively to the pressure relief valves tosimultaneously open and close the respective pressure relief valves inresponse to the pressure level measurement.

In response to a second failure condition of either one of the hydrauliccircuits, either one of the pressure relief valves can automaticallyfault closed regardless of the pressure level measurement.

In one configuration, the assembly can comprise a manifold having theone or more flow inlets and having one or more flow outlets. The one ormore flow inlets can be disposed in fluid communication with an upstreamportion of the drilling system and can receive the fluid flow therefrom.The one or more flow outlets can be disposed in fluid communication witha downstream portion of the drilling system and can deliver the fluidflow thereto.

In one configuration, the assembly can further comprise sensorscommunicatively connected to the controllers and providing readings forthe pressure level measurement of the drilling system.

In one configuration, the assembly can further comprise a plurality ofsensors distributed in the hydraulic circuits and measuring a pluralityof operational parameters. Both of the controllers can receive theoperational parameters. Either one of the controllers can detect asecond failure condition associated with the operational parameters fromone of the hydraulic circuits and can automatically fault the respectivepressure relief valve closed in response to the second failure.

For this configuration, the hydraulic circuits can comprise pumpsconnected to a pneumatic supply and pumping the hydraulic motive force.A first of the sensors can comprise a first pressure transducermeasuring pressure of the pneumatic supply as one of the operationalparameters. The pumps connected to the pneumatic supply can pump thehydraulic motive force to a common hydraulic input for the hydrauliccircuits, and a second of the sensors can comprise a second pressuretransducer measuring the common hydraulic input as one of theoperational parameters. One or more accumulators can be connected to thecommon hydraulic input. The hydraulic circuits can provide the hydraulicmotive force in the event of failure of either one of the pumps.

For this configuration having the sensors, a third of the sensors cancomprise a third pressure transducer measuring pressure of the hydraulicmotive force to a first the pressure relief valves as one of theoperational parameters. Either one of the controllers can detect themeasured pressure below a first threshold as the second failurecondition and can automatically fault the first pressure relief valveclosed in response thereto. Further, a fourth of the sensors cancomprise a fourth pressure transducer measuring pressure of thehydraulic motive force to a second the pressure relief valves as one ofthe operational parameters. Either one of the controllers can detect themeasured pressure below a second threshold as the second failurecondition and can automatically fault the second pressure relief valveclosed in response thereto.

In one configuration, each of the controllers is communicativelyconnected to a position sensor of each of the pressure relief valves.Either one of the controllers can detect either one of the pressurerelief valves failing to open as the second failure condition.

In one configuration, each of the hydraulic circuits can comprise anelectrically-driven directional control valve having a default no-flowstate and an active flow state. Both of the electrically-drivendirectional control valves are connected to a common hydraulic input.

In this configuration, each of the controllers can be communicativelyconnected to the electrically-driven directional control valves of bothof the hydraulic circuits to provide a control signal thereto. In thesecond failure condition, either of the controllers can be configured toautomatically fault a respective one of the pressure relief valvesclosed in response to a failure of the respective electrically-drivendirectional control valve; and/or the hydraulic motive force can beprovided in the open circuit of a first of the hydraulic circuits in theevent of a failure of the electrically-driven directional control valvein a second of the hydraulic circuits, where the pressure relief valveof the second hydraulic circuit defaults to a closed condition.

In this configuration comprising electrically-driven directional controlvalves, each of the hydraulic circuits can comprise a pair of open andclose hydraulically-driven directional control valves connected to thecommon hydraulic input. The open hydraulically-driven directionalcontrol valve can have a default closed state and an active openedstate. The close hydraulically-driven directional control valve can havea default opened state and an active closed state. The active openedstate can provide an open output of the hydraulic motive force to openthe respective pressure relief valve. The default opened state canprovide a close output of the hydraulic motive force to close therespective pressure relief valve. The open and closehydraulically-driven directional control valves can each have therespective default state in response to the electrically-drivendirectional control valve having the default no-flow state, and each canhave the respective active state in response to the electrically-drivendirectional control valve having the active flow state.

In this configuration comprising electrically-driven directional controlvalves, each of the hydraulic circuits can comprise a pair of dischargehydraulically-driven directional control valves. A first of dischargehydraulically-driven directional control valves can be connected to theopen output and can have a default open state and an active close state.The default open state can communicate with a discharge. A second of thedischarge hydraulically-driven directional control valves can beconnected to the close output of the close hydraulically-drivendirectional control valve and can have a default closed state and anactive opened state. The active opened state can communicate with thedischarge. The discharge hydraulically-driven directional control valvescan each have the respective default state in response to theelectrically-driven directional control valve having the default no-flowstate, and each can have the respective active state in response to theelectrically-driven directional control valve having the active flowstate. Each close output can comprise a pilot-operated check valvepiloted by the respective open output.

According to the present disclosure, an assembly is used with a buffermanifold for relieving pressure of fluid flow in a drilling system. Thedrilling system has a pneumatic supply, and the buffer manifold has oneor more flow inlets, one or more flow outlets, and first and secondpressure relief valves. The one or more flow inlets are disposed influid communication with an upstream portion the drilling system andreceive the fluid flow therefrom. The one or more flow outlets aredisposed in fluid communication with a downstream portion the drillingsystem and deliver the fluid flow thereto. The first and second pressurerelief valves are disposed in fluid communication between the one ormore flow inlets and the one or more flow outlets and are disposed influid communication with at least one discharge outlet. Each of thefirst and second pressure relief valves is operable to open and closefluid communication with the at least one discharge outlet.

The control assembly comprises a hydraulic arrangement, a plurality ofsensors, and a pair of controllers. The hydraulic arrangement isoperably connected to the first and second pressure relief valves and isconnected to the pneumatic supply. The hydraulic arrangement is poweredby the pneumatic supply and provides hydraulic motive force in twohydraulic circuits respectively to the first and second pressure reliefvalves. The two hydraulic circuits are cross-connected to one another.

The sensors are distributed in the hydraulic arrangement and measure aplurality of operational parameters of the hydraulic arrangement. Thecontrollers are operably connected to the hydraulic arrangement. Each ofthe controllers receives the operational parameters from the sensors andreceives a pressure level measurement of the drilling system. Both ofthe controllers control the hydraulic motive force provided in the twohydraulic circuits respectively to the first and second pressure reliefvalves to open and close the first and second pressure relief valves inresponse to the pressure level measurement.

According to the present disclosure, a method of controlling fluid flowin a drilling system comprises: receiving the fluid flow from anupstream portion of the drilling system at one or more flow inlets of amanifold assembly; in response to a first pressure level measurement ofthe drilling system, flowing the fluid flow out one or more flow outletsof the manifold assembly to a first downstream portion of the drillingsystem in response thereto; in response to a second pressure levelmeasurement of the drilling system, flowing the fluid flow out at leastone discharge outlet of the manifold assembly to a second downstreamportion of the drilling system, instead of out the one or more flowoutlets, by simultaneously controlling, with controllers, hydraulicmotive force provided in hydraulic circuits respectively to pressurerelief valves to independently open the respective pressure reliefvalve; in response to a first failure condition of either one of thecontrollers, independently controlling, with the other one of thecontrollers, the hydraulic motive force provided in the hydrauliccircuits respectively to the pressure relief valves to simultaneouslyopen and close the respective pressure relief valves in response to thefirst and second pressure level measurements; and in response to asecond failure condition of either one of the hydraulic circuits,automatically faulting either one of the pressure relief valves closedregardless of the first and second pressure level measurements.

To provide the hydraulic motive force in the hydraulic circuits of thehydraulic arrangement respectively to the pressure relief valvescontrolled by the controllers, the method can comprise powering pumpingof the hydraulic motive force in n the hydraulic circuits with apneumatic supply.

In automatically faulting either one of the pressure relief valvesclosed, both of the pressure relief valves can be automatically faultedclosed in response to a total loss of power.

To automatically fault either one of the pressure relief valves closed,the method can comprise: measuring a plurality of operational pressuresof the hydraulic arrangement using a plurality of pressure transducersdistributed in the hydraulic arrangement; receiving the operationalpressures from the pressure transducers at the controllers; and faultingthe pressure relief valves closed in response to at least one of theoperations pressure exceeding a pressure limit.

To provide the hydraulic motive force in the hydraulic circuits of thehydraulic arrangement respectively to the pressure relief valvescontrolled by the controllers, the method can comprise routing thehydraulic motive force in the hydraulic circuits cross-connected to oneanother.

To open the at least one pressure relief valve with the at least onecontroller in response to the second pressure level measurement, themethod can comprise communicating both of the pressure relief valves influid communication between the one or more flow inlets and the one ormore flow outlets and in fluid communication with at least one dischargeoutlet, each of the pressure relief valves being operable to open andclose fluid communication with the at least one discharge outlet, bothof the controllers operably connected to the hydraulic arrangementcontrolling the hydraulic motive force provided in the hydrauliccircuits respectively to the pressure relief valves to open and closethe pressure relief valves.

The foregoing summary is not intended to summarize each potentialembodiment or every aspect of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a drilling system according to the presentdisclosure.

FIG. 2A illustrates a schematic view of a pressure relief system of thepresent disclosure for the drilling system.

FIG. 2B illustrates an isolated view of a buffer manifold for thedrilling system.

FIG. 3 illustrates a graph of pressures used by the pressure reliefsystem.

FIG. 4 illustrates a cross-sectional view of a plug type valve for useas a pressure relief valve for the disclosed system.

FIG. 5 illustrates a schematic view of a processing control unit for thedisclosed pressure relief system.

FIG. 6 illustrates a schematic view of a hydraulic control unit for thedisclosed pressure relief system.

DETAILED DESCRIPTION OF THE DISCLOSURE A. Drilling System

FIG. 1 diagrams a drilling system 10 according to the presentdisclosure. As shown and discussed herein, this system 10 is aclosed-loop system for controlled pressure drilling and can be a ManagedPressure Drilling (MPD) system and, more particularly, a ConstantBottomhole Pressure (CBHP) form of MPD system. Although discussed inthis context, the teachings of the present disclosure can apply equallyto other types of drilling systems, such as conventional drillingsystems, other MPD systems (Pressurized Mud-Cap Drilling,Returns-Flow-Control Drilling, Dual Gradient Drilling, etc.) as well asto Underbalanced Drilling (UBD) systems, as will be appreciated by oneskilled in the art having the benefit of the present disclosure.

The drilling system 10 is depicted for use offshore on a rig 12, such asa floating, fixed, or semi-submersible platform or vessel known in theart, although teachings of the present disclosure may apply to otherarrangements. The drilling system 10 uses a riser 20 extending between adiverter 24 on the rig floor 14 to a blow-out preventer stack 40 on thesea floor. The riser 20 connects by a riser joint 22 from the diverter24 and includes a rotating control device (RCD) 30, an annular isolationdevice 32, and a flow spool 34 disposed along its length. A drill string16 having a bottom hole assembly (BHA) and a drill bit extends downholethrough the riser 20 and into a wellbore 18 for drilling into aformation.

During operations, the riser 20 can direct returns of drilling fluids,wellbore fluids, and earth-cuttings from the subsea wellbore 18 to therig 12. In some conventional forms of operation, the diverter 24 candirect the returns of drilling fluid, wellbore fluid, and earth-cuttingsto a mud gas separator 90 and other element to separate out the drillingfluid for potential recycle and reuse, and to separate out gas.

In certain situations, the BOP stack 40 can be operated to close offflow of the returns in the riser 20. The BOP stack 40 may have one ormore annular or ram-style blow out preventers on a subsea wellhead, andpreventers on the BOP stack 40 can be controlled by various controllines (not shown) from equipment on the rig 12. In certain situations ofan uncontrolled release of wellbore fluids (e.g. high-pressure liquidand/or gas streams) during drilling, the riser 20 with its rotatingcontrol device 30, annular isolation device 32, and flow spool 34 can beconfigured to divert the uncontrolled wellbore fluid flow in acontrolled fashion as described below.

In managed pressure drilling, the rotating control device 30, which caninclude any suitable pressure containment device, keeps the wellbore 18in a closed-loop at all times while the wellbore 18 is being drilled. Todo this, the rotating control device (RCD) 30 sealingly engages (i.e.,seals against) the drilling string 16 passing in the riser 20 and cancontain and divert annular drilling returns through a flow line 31 cthat connects to downstream flow controls on the rig 12. In this way,the rotating control device 30 can complete the circulating system tocreate the closed-loop of incompressible drilling fluid.

A hydraulic power unit 31 a on the rig 12 can connect by control lines31 b to the rotating control device 30 to control its operation. Thecontrol lines 31 b can carry supply and/or return of hydraulic fluid toand from the rotating control device 30 for its operation.

The annular sealing device 32 can be used to sealingly engage (i.e.,seal against) the drillstring 16 or to fully close off the riser 20 whenthe drillstring 16 is removed so fluid flow up through the riser 20 canbe prevented. Typically, the annular sealing device 32 can use a sealingelement that is closed radially inward by hydraulically actuatedpistons. Control lines 33 from rig controls 57 can be used forcontrolling the annular sealing device 32.

The flow spool 34 includes a number of controllable valves and connectsby flow lines 35 to the downstream flow controls on the rig 12 describedbelow. The controllable valves of the flow spool 34 can be opened andclosed using control lines 33 from the rig controls 57.

As shown in FIG. 1, the flow controls downstream of the rotating controldevice 30, the annular sealing device 32, and the flow spool 34 includea managed pressure drilling buffer manifold 60 and a choke manifold 70.The buffer manifold 60 connects by the flow lines 31 c and 35 from therotating control device 30 and the flow spool 34 and receives flowreturns during drilling operations. A buffer manifold hydraulic powerunit 55 operates the buffer manifold 60. Among other components, thebuffer manifold 60 has pressure relief valves 64 a-b, pressure sensors(not shown), electronic valves (not shown), and other components tocontrol operation of the manifold 60.

The choke manifold 70 is downstream from the buffer manifold 60. Thechoke manifold 70 can produce surface backpressure to perform managedpressure drilling with the drilling system 10 and can measure parametersof the flow returns. Among other components, for example, the chokemanifold 70 has flow chokes 72, a flowmeter 74, pressure sensors (notshown), a local controller (not shown), and the like to controloperation of the manifold 70. A hydraulic power unit (not shown) and/orelectric motor of the choke manifold 70 can actuate the chokes 72.

In addition to these components, the system 10 also includes mud pumps42; a mud standpipe manifold 46 for a standpipe (not shown); a choke &kill manifold 80 having kill and choke lines 82, 84 for the BOP stack40; a mud gas separator 90; and various other components. Duringdrilling operations, these components can operate in a known manner.

Finally, a control system 50 of the drilling system 10 integrateshardware, software, and applications across the drilling system 10 andis used for monitoring, measuring, and controlling parameters in thedrilling system 10. For example, the control system 50 can be integratedwith or communicatively coupled to the RCD hydraulic power unit 31 a,the buffer manifold hydraulic power unit 55, the buffer manifold 60, thechoke manifold 70, and other components. During standard operatingconditions, the drilling control system 50 operates the variouscomponents to operate the drilling system 10.

In the contained environment of the closed-loop drilling system 10, forexample, minute influxes or losses in the wellbore 18 are detectable atthe surface, and the control system 50 can further analyze pressure andflow data to detect kicks, losses, and other events. In turn, at leastsome operations of the drilling system 10 can then be automaticallyhandled by the control system 50.

To monitor operations, the control system 50 can use data from a numberof sensors and devices in the system 10. For example, one or moresensors can measure pressure in the standpipe. One or more sensors (La,stroke counters) can measure the speed of the mud pumps 42 for derivingthe flow rate of drilling fluid into the drillstring 16. In this way,flow into the drillstring 16 may be determined from strokes-per-minuteand/or standpipe pressure.

One or more sensors can measure the volume of fluid in the mud tanks 44and can measure the rate of flow into and out of mud tanks 44. In turn,because a change in mud tank level can indicate a change in drillingfluid volume, flow-out of the wellbore 18 may be determined from thevolume entering the mud tanks 44.

Rather than relying on conventional pit level measurements, the controlsystem 50 can use the flowmeter 74, such as a Coriolis mass flowmeter,on the choke manifold 70 to capture fluid data—including mass and volumeflow, mud weight (i.e., density), and temperature—from the returningannular fluids in real-time, at a sample rate of several times persecond. Because the Coriolis flowmeter gives a direct mass ratemeasurement, the flowmeter 74 can measure gas, liquid, or slurry. Othersensors can be used, such as ultrasonic Doppler flowmeters, SONARflowmeters, magnetic flowmeter, rolling flowmeter, paddle meters, etc.

Additional sensors can measure mud gas, flow line temperature, muddensity, and other parameters. For example, a flow sensor can measure achange in drilling fluid volume in the well. Also, a gas trap, such asan agitation gas trap, can monitor hydrocarbons in the drilling mud atsurface. To determine the gas content of drilling mud, for example, thegas trap mechanically agitates mud flowing in a tank. The agitationreleases entrained gases from the mud, and the released gases aredrawn-off for analysis. The spent mud is simply returned to the tank 44to be reused in the drilling system 10.

During operations, the drill string 16 passing from the rig 12 canextend through the riser 20 and through the BOP stack 40 for drillingthe wellbore 18. As the drillstring 16 is rotated, the rotating controldevice 30 seals the annulus between the drillstring 16 and the riser 20to conduct a managed pressure drilling operation. In this way, flowreturns having drilling fluid, wellbore fluid, and cuttings flow upthrough the annulus between the drillstring 16 and the riser 20 to therotating control device 30, which diverts the flow returns through theflow line 31 c to the buffer manifold 60.

The fluid data and other measurements noted herein are transmitted tothe control system 50, which in turn operates drilling functions. Inparticular, the control system 50 can operate the automated chokemanifold 70, which manages pressure and flow during drilling and whichis incorporated into the drilling system 10 downstream from the rotatingcontrol device 30 and buffer manifold 60 and upstream from the gasseparator 90.

In general, the buffer manifold 60 can direct the flow returns invarious way as needed. During standard operating conditions, the buffermanifold 60 passes the flow returns to the choke manifold 70. Theautomated choke manifold 70 measures the return flow (e.g., flow-out)and density using the flowmeter 74 installed in line with the chokes 72.Software components of the control system 50 then compares the flow ratein and out of the wellbore 18, the injection pressure (or standpipepressure), the surface backpressure (measured upstream from the drillingchokes 72), the position of the chokes 72, and the mud density, amongother possible variables. Comparing these variables, the control system50 then identifies minute downhole influxes and losses on a real-timebasis and control surface backpressure with the chokes 72 to manage theannulus pressure during drilling.

By identifying the downhole influxes and losses during drilling, forexample, the control system 50 monitors circulation to maintain balancedflow for constant BHP under operating conditions and to detect kicks andlost circulation events that jeopardize that balance. The drilling fluidis continuously circulated through the system 10, the buffer manifold60, the choke manifold 70, and the flowmeter 74. As will be appreciated,the flow values may fluctuate during normal operations due to noise,sensor errors, etc. so that the system 50 can be calibrated toaccommodate such fluctuations. In any event, the control system 50measures the flow-in and flow-out of the well and detects variations. Ingeneral, if the flow-out is higher than the flow-in, then fluid is beinggained in the system 10, indicating a kick. By contrast, if the flow-outis lower than the flow-in, then drilling fluid is being lost to theformation, indicating lost circulation.

To then control pressure, the control system 50 introduces pressure andflow changes to the incompressible circuit of fluid at the surface tochange the annular pressure profile in the wellbore. In particular,using the choke manifold 70 to apply surface backpressure within theclosed loop, the control system 50 can produce a reciprocal change inbottom hole pressure. In this way, the control system 50 uses real-timeflow and pressure data and manipulates the annular backpressure tomanage wellbore influxes and losses.

During operations, certain events may occur that require reconfiguringof flow controls. For example, the drillstring 16 may be lifted out ofthe riser 20, and the annular sealing device 32 may be actuated to closeoff the riser 20. The controllable valves on the flow spool 34 can beoperated to direct fluid in the riser 20 below the rotating controldevice 32 through the flow lines 35 to the buffer manifold 60.

In other examples, certain events or failures, such as an uncontrolledrelease of wellbore fluids, may occur. In this case, the annular sealingdevice 32 can be actuated to seal off the annulus around the drillstring16 (if present). The rotation of the drillstring 16 can be stoppedduring the event, or the annular sealing device 32 may be capable ofsealing against the drillstring 16 while rotating. Either way, thecontrollable valves on the flow spool 34 can be operated to direct fluidin the riser 20 below the annular sealing device 32 through the flowlines 35 to the buffer manifold 60.

Additional events may occur requiring the pressure relief system 100 todivert fluid flow overboard, to trip tanks 44, or to other fluidhandling components. For example, an uncontrolled release of wellborefluids may occur, and the annular flow in the riser 20 captured by therotating control device 30 or the annular sealing device 32 may need tobe relieved to protect the formation or to protect the equipment of thesystem. To relieve the system 10 of overpressure, a pressure reliefsystem 100 operates pressure relief valves 64 a-b on the buffer manifold70 to divert the flow returns from the flow lines 31 c, 35 overboard, totrip tanks 44, or to other fluid handling components. This diversion canthen prevent the overpressure flow from damaging the riser 20 andpassing on to the choke manifold 70.

As schematically shown, components of the pressure relief system 100 canbe incorporated into the buffer hydraulic power unit 55, althoughseparate configurations are possible. As discussed in more detail below,the pressure relief system 100 has an integrated PLC based controlsystem and a hydraulic control unit (HCU) and is connected to thepressure relief valves 64 a-b and other components of the buffermanifold 60 by control lines 105. The pressure relief system 100 canopen and close the pressure relief valves 64 a-b simultaneously. Whenopened, the redundant pressure relief valves 64 a-b provide pressurerelief in the event of over-pressurization of the wellbore 18 and/orsurface equipment. Once opened, the pressure relief system 100 providesa further function of closing the pressure relief valves 64 a-b toprevent an induced kick from occurring after the relief of overpressure.

The pressure relief valves 64 a-b are configured to nominally fail inthe closed position. There may be several reasons for this. Primarily,the purpose of the MPD drilling system 10 is to impose dynamicbackpressure on the wellbore 18 using the choke manifold 70. If one ofthe pressure relief valve 64 a-b fails open, then backpressure cannot bemaintained. Additionally, the wellbore 18 is normally in static ordynamic balance so a demand for overpressure protection of equipment isless likely to occur. Instead, the more likely cause of an open commandto the pressure relief valves 64 a-b would be to protect the formation.

B. Pressure Relief System

As hinted to above, the pressure relief system 100 can operate in astand-alone mode to protect against process upsets during drilling withthe drilling system 10. As schematically shown in FIG. 2A, the pressurerelief system 100 includes a sensor arrangement 110, a processingcontrol unit 120, and a hydraulic control unit 130 for the buffermanifold 60. Power from a power supply 140 can be common to the threeelements 110, 120, and 130 of the system 100.

As described in more detail below, each of the elements 110, 120, 130,and 140 includes redundancies so that a fault of a component in oneelement does not fault other components of that element nor faultcomponents of the other elements. To achieve the required redundancy,the system 100 is more than just a combination of one pressure reliefvalve having its control console with another pressure relief valvehaving its own control console. In such an arrangement, limited faultprotection would be achieved as discussed in the background section ofthe present disclosure. Instead, the pressure relief system 100disclosed herein addresses multiple points of failure in the disclosedarrangement by providing a redundancy at that point of failure, byproviding independent monitoring of that point of failure, and bypreventing a fault at that point of failure from translating to a faultof the redundancy. In this way, the disclosed pressure relief system 100provides a redundant, fault-tolerant integration of sensing, processing,hydraulic, and power elements 110, 120, 130, and 140 for the redundantpressure relief valves 64 a-b.

As briefly shown here and described in more detail below, the sensorarrangement 110 includes sensors 112, 116 and electrical buffers 114,and the processing control unit 120 includes two programmable logiccontrollers (PLCs) 122 a-b. The hydraulic control unit 130 provideshydraulic valve control for the two pressure relief valves 64 a-b of themanifold 60.

The sensors in the arrangement 110 include transducers 112 receivingpressure and other measurements from pneumatic and hydraulic sources.These transducers 112 can be distributed in the hydraulic control unit130 in the manifold 60. The sensors in the arrangement 110 also includesensors 116 receiving line or process pressures from the drilling system(10). These sensors 116 can be disposed on the flow line entering theinlet 62 a of the buffer manifold 60. These sensors 116 measureredundant measurements of the process pressure, and voting between thesensor measurements can be used in decisions of the processing controlunit 120.

The buffer manifold 60 in FIG. 2A is used for directing process flow invarious ways. The manifold 60 includes one or more flow inlets 62 adisposed in fluid communication with an upstream portion of the drillingsystem (10) and receives the fluid flow therefrom. The manifold 60 alsoincludes one or more flow outlets 62 b disposed in fluid communicationwith a downstream portion of the drilling system (10) and delivers thefluid flow thereto. Finally, the manifold 60 includes at least onedischarge outlet 65 to relieve pressure.

In the context of the present disclosure, the pressure relief valves 64a-b are used for relieving pressure of fluid flow in the drilling system(10: FIG. 1) in response to a pressure level measurement, such as a flowline pressure from the sensors 116, being over a limit. For instance, asshown in FIG. 2B, the manifold 60 has a number of inlets 62 a andreceives fluid from the RCD (30) via flow lines 31 c, receives flow fromthe flow spool (34) via flow lines 35, receives flow from the choke/killmanifold (80), etc. The manifold 60 has a number of outlets 62 b anddelivers flow returns to the choke manifold (70), to the choke/killmanifold (80), trip tank (44), and other downstream portions of thedrilling system (10) instead of to the choke manifold (70).

Internally, the manifold 60 includes a number of solenoid actuated gatevalves 66, flow tees, manifold elements, piping, etc. for controllingflow between the inlets 62 a and the outlets 62 b during drillingoperations. The buffer unit 55 interfaces with the solenoid actuatedgate valves 66 for directing flow according to operational needs. Forits part, the pressure relief system 100, which can part of the bufferunit 55 and which includes the elements 110, 120, 130, 140, of FIG. 2Ainterfaces with the pressure relief valves 64 a-b to relieveoverpressure from the inlets 62 a to the discharge outlets 65.

As can be seen in the manifold 60 as shown in FIGS. 2A-2B, the redundantpressure relief valves 64 a-b are disposed in fluid communicationbetween the one or more flow inlets 62 a and the one or more flowoutlets 62 b and disposed in fluid communication with the at least onedischarge outlet 65. Each of the redundant pressure relief valves 64 a-bis operable to open and close fluid communication with the at least onedischarge outlet 65.

The hydraulic control unit 130 in FIG. 2A has a hydraulic arrangementoperably connected to the redundant pressure relief valves 64 a-b.Redundant hydraulic circuits of the unit 130 are cross-connected to oneanother and are operably connected to the redundant pressure reliefvalves 64 a-b. The redundant hydraulic circuits provide hydraulic motiveforce respectively to the redundant pressure relief valves 64 a-b.

The transducers 112 are distributed in the redundant hydraulic circuitsof the hydraulic control unit 130 and measure operational parameters ofthe hydraulic circuits to diagnose the unit 130 and its operation. Theother sensors 116 are distributed to measure line or process pressure ofthe manifold's inlets 62 a as the pressure level measurement used inactivating or deactivating the pressure relief system 100. These sensors116, for example as shown in FIG. 2B, can be disposed on the flow line31 c from the RCD (30) leading into the inlet 62 a of the buffermanifold 60.

In general, two or more of these sensors 116 can be used for redundancy.In a particular arrangement, four sensors 116 can be used to measure theprocess pressure at the same point of the flow line to the inlet 62 a.Each of these sensors 116 can be the same as one another (i.e., have thesame ratings, same sensitivities, etc.) for redundant verification ofthe pressure measurements. In fact, the sensors 116 can be identical. Inother arrangements, one or more of the sensors 116 may have differentratings, sensitivities, or the like from the other sensors 116.

In the processing unit 120, the redundant controllers 122 a-b areoperably connected to the redundant hydraulic circuits of the hydrauliccontrol unit 130. Each of the redundant controllers 122 a-b receives theoperational parameters from the transducers 112 and also receivespressure level measurements of the drilling system (10) for the sensors116. Both of the redundant controllers 122 a-b in a standard operatingcondition then simultaneously control the hydraulic motive forceprovided in the redundant hydraulic circuits of the hydraulic unit 130respectively to the redundant pressure relief valves 64 a-b toindependently open and close the respective pressure relief valve 64 a-bin response to the pressure level measurement from the line pressuresensors 116.

Additional details of the processing unit 120 are disclosed in FIG. 5,and additional details of the hydraulic control unit 130 are disclosedin FIG. 6.

C. Modes of Operation

The system 100 is a redundant, fault tolerant, pressure protectionsystem used in the operation of the two pressure relief valves 64 a-bintended for protection of process or line pressure in the drillingsystem (10: FIG. 1). For fault tolerance, the pressure relief system 100is operable in response to different failure or fault conditions. Inresponse to a first failure condition of either one of the redundantcontrollers 122 a-b, for example, the other one of the redundantcontrollers 122 a-b independently controls the hydraulic motive forceprovided in the redundant hydraulic circuits of the hydraulic unit 130respectively to the redundant pressure relief valves 64 a-b tosimultaneously open and close the respective pressure relief valves 64a-b in response to the pressure level measurement from the line pressuresensors 116. In response to a second failure condition of either one ofthe redundant hydraulic circuits of the hydraulic unit 130, however,either one of the redundant pressure relief valves 64 a-b automaticallyfaults closed regardless of the pressure level measurement from the linepressure sensors 116.

In the configuration of the manifold 60, one pressure relief valve 64a-b and its associated electrical, hydraulic, or pneumatic controls iscapable of relieving excess line pressure. In case of single pointfailure failing one pressure relief valve 64 a-b, the failed pressurerelief valve 64 a-b fails closed allowing the remaining pressure reliefvalve 64 a-b and its associated electrical, hydraulic, or pneumaticcontrols to continue to maintain control over line pressure and relievepressure as needed. (As to be understood herein, having a valve “failclosed” refers to the failed valve closing, as opposed to the valvesimply failing-in-place—i.e., the valve staying in its currentposition.)

For overpressure protection, the pressure relief system 100 iscontrolled by a user-defined setpoint 124, which can be set over apressure range to a coded equipment protection setpoint 126. Theuser-defined setpoint 124 can be entered locally at a console orremotely by computer using an interface application. Under normaloperation, exceeding the setpoint 124 for line pressure causes bothpressure relief valves 64 a-b to open to relieve line pressure.Thereafter, when line pressure is reduced, both pressure relief valves64 a-b then close.

For additional reference, FIG. 3 illustrates a graph of pressure setpoints and values used by the pressure relief system 100. Theuser-defined setpoint 124 to open the two pressure relief valve 64 a-bis a dynamic process protection level (PPL) setpoint 124, which extendsover a pressure range from 0 to a hard-coded equipment protection level(EPL) setpoint 126.

The dynamic setpoint 124 is the “open” setpoint for the pressure reliefvalves 64 a-b, indicating the pressure level set for the pressure reliefvalves 64 a-b to open and relieve process pressure for overpressureprotection. The dynamic setpoint 124 allows operators to limit theapplied surface backpressure while (a) drilling narrow margin wells(well protection setpoint) and while (b) during short periods for makeand break of drilling stands (connections setpoint.)

The equipment protection setpoint 126 is hard-coded and is set based onthe lowest pressure rating. The dynamic setpoint 124 (valve opens) maycover a range of pressure from 0 to 80% of riser (or surface equipment)maximum allowable operating pressure (MAOP). Typically, the MAOP isseparately hard coded into the programmable logic controllers 122 a-b toprotect the riser (20) and surface equipment (60, 70, etc.).

During operation, the process sensors (116) measure the process pressureat the inlet (62 a) of the manifold (60) to provide the current line orprocess pressure 128. Because multiple sensors 116 are used, a votingscheme between the sensors' measurements can be used to decide what thecurrent line pressure 128 is. For example, the voting scheme can decidethe pressure 128 from an average of the three closest measurements, orsome other scheme can be used. Thus, if one sensor 116 makes a momentaryerroneous measurement, it need not be relied upon.

The current line pressure 128 is compared to the dynamic setpoint 124,which can be changed, for example, (a) during drill-pipe make-and-break,(b) as the wellbore (18) is deepened and new geological structures areencountered, and (c) when conducting formation integrity tests (FIT) orleak off tests (LOT). Therefore, as the drilling process goes throughdifferent operations, the dynamic setpoint 124 is changed sooverpressure protection is provided in the manner best suited to thedrilling operations at the time.

Under normal operation, having the current line pressure 128 exceed thedynamic setpoint 124 results in both pressure relief valves 64 a-bopening simultaneously in order to reduce pressure. Thereafter, bothpressure relief valves 64 a-b close at a trailing setpoint 125 in orderto prevent an induced kick from occurring due to the relief of pressure.The trailing setpoint 125 is the close setpoint for when the valves 64a-b close after opening. The trailing setpoint 125 may be hard coded at80% of the dynamic open setpoint 124.

For its part, the hard-coded equipment protection setpoint 126simultaneously opens both pressure relief valves 64 a-b in order toprotect the riser (20) and surface equipment from overpressure. Althoughone form of voting between the measurements of the pressure sensors(116) can be used to determine whether the current line pressure 128 hasreached the equipment protection setpoint 126, preferably the equipmentprotection setpoint 126 is triggered by another form of voting when anyone of the pressure sensors 116 reports a measured value exceeding theequipment protection setpoint 126.

After opening due to triggering from the equipment protection setpoint126, both pressure relief valves 64 a-b then close at a trailingsetpoint (not shown) in order to prevent an induced kick. As noted, theopen equipment protection setpoint 126 is nominally set at 80% ofmaximum allowable operating pressure (MAOP). The trailing close setpointused after opening for the equipment protection may correspond to thedynamic close setpoint 124. This may ensure that the well is bought backto a state previously identified as being required to drill the wellboreor make the connection.

The dynamic setpoint 124 allows backpressure adjustment duringmake-and-break of drillpipe of the drillstring (16). When makingconnections in the system (10) of FIG. 1, for example, the mud pumps(42) are stopped prior to making a connection. This results in a loss ofequivalent circulating density (ECD), which in turn reduces downholepressure. The drilling system (10) is used to compensate for the loss ofECD by increasing the backpressure applied at the chokes (72) of thechoke manifold (70). The increase in backpressure may be several hundredPSI, which means the dynamic setpoint 124 must be increased to a valueequal to surface backpressure (SBP) plus a margin (M) that prevents thepressure relief valves (64 a-b) from opening erroneously. In practice,the adjustment of the dynamic setpoint 124 may be reviewed with theconnection every drillpipe stand. However, if the ‘open’ dynamicsetpoint 124 is triggered, then there is a risk of an influx that couldescalate to a loss of well control. For this reason, the processing unit(120) is programmed to close the pressure relief valves (64 a-b) withthe trailing ‘close’ setpoint 125.

The dynamic setpoint 124 also provides wellbore protection whiledrilling. For example, the pressure relief valves (64 a-b) must open ata dynamic setpoint 124 chosen by the driller whose goal is to protectthe open formation against fracture. If the hydrostatic and appliedbackpressure from the column of drilling mud is too high, then drillingfluid may be lost into the formation. The dynamic open setpoint 124 maybe up to 80% of MAOP (e.g. if RCD is rated for 2000 psi, 80% of the MAOPis 1600 psi), leaving no pressure margin and time-delay between relieffor well protection, and equipment overpressure. Opening the pressurerelief valves (64 a-b) results in a significant and rapid loss ofsurface back pressure, so both pressure relief valves (64 a-b)preferably close at the trailing setpoint 125 to minimize an inducedkick. The trailing close setpoint 125 may be set at 80% of the dynamicopen setpoint 124. If the dynamic setpoint 124 is set high and one orboth pressure relief valves (64 a-b) fails to close, then there is therisk of an induced kick that could escalate to blow out after a periodof minutes or hours. In this situation, the driller would have to securethe well.

Other than the modes of operation for making connections and wellprotection, the pressure relief system 100 operates in an equipmentprotection mode to open and close in emergency scenarios where highsurface pressure (i.e., overpressure) is detected in the line pressureat the inlets (62 a) of the manifold (60). There are two primaryscenarios. First, the return flow path of the MPD system (10) is blocked(e.g. by an inadvertently closed valve). Alternatively, a gas kick hasbeen transported or migrated to surface, resulting in a threat ofequipment overpressure. In both cases, the pressure relief valves (64a-b) open at the dynamic setpoint 124 to relieve pressure and then closeat the trailing setpoint 125 to maintain backpressure on the well.

The programming in the controllers (122 a-b) for the dynamic setpoint124 does not allow the operator to enter a value greater than the opensetpoint 126 for equipment protection. This means the dynamic opensetpoint 124 operates first, thereby preventing conflicting commandsfrom the controllers (122 a-b) (i.e., simultaneous close for dynamicsetpoint 124, and open for equipment protection 126).

D. Pressure Relief Valve

The pressure relief valves 64 a-b of the disclosed pressure reliefsystem 100 can be a plug type valve rated for high-pressure service indrilling applications, although other types of valves, chokes, and thelike can be used. As a brief example, FIG. 4 schematically illustrates aplug type valve that can be used for the system's pressure relief valve64. The valve 64 includes a body 150, a plug 160, and a hydraulicactuator 168.

An interior 152 of the valve body 150 has an inlet 154 and an outlet 156with a seat 155 disposed therebetween. The plug 160 is sealed in theinterior 152 and is movable relative to the seat 155. As shown here, thehydraulic actuator 168 is a piston connected to the plug 160 by a stem162. The actuator 168 is sealed in a hydraulic chamber 158 communicatingwith hydraulic ports 159 a-b. Other hydraulic arrangements, such asscroll screw actuators, choke actuators, or the like, can be used forthe actuator 168.

Operation of the valve 64 is achieved via the hydraulic actuator 168integral to the plug 160. The air-driven hydraulic power unit (130: FIG.2A) provides motive force to the actuator 168 via the ports 159 a-b. Aposition or proximity sensor 157 can be used with the actuator 168 to atleast indicate that the valve 64 is open.

The valve 64 is held closed by line pressure at the input 154 actingagainst the plug 160 and by application of the piston force of theactuator 168. Reversing the hydraulic pressure acting across theactuator 168, to a point where piston force exceeds well fluid force,opens the valve 64. This moves the plug 160 off the seat 155 at whichpoint downstream pressure assists opening, and line flow can pass fromthe inlet 154 to the outlet 156.

E. Processing Control Unit

FIG. 5 illustrates a schematic of the processing control unit 120 forthe disclosed pressure relief system 100. The processing control unit120 uses an electric control panel containing duplicate power inputsources (AC-1, AC-2), duplicate power supplies 140, redundant failsafeprogrammable logic controllers (PLC) 122 a-b, and redundant sensorinputs via a communication interface 105 with the hydraulic control unit(130).

The processing unit 120 can further use fusing to prevent cascadeelectrical faults, a connection for a local HMI display 104 a, and afiber optic interface for remote operation by other processing equipment104 b, such as in a driller's cabin on the rig. Instrumentation can beincluded to reveal any electronic failure of components. The local andremote interfaces 104 a-b are redundant of one another so one could beused in the absence or failure of the other. In general, the interfaces104 a-b can provide setup, configurations, alarms, diagnostics, and thelike for both controllers 122 a-b.

The two programmable logic controllers 122 a-b operate in a fullyparallel, redundant configuration. The controllers 122 a-b can bepowered by the duplicate AC power input sources (AC-1, AC-2), andduplicate DC power supplies 140. One power source (AC-1) can be rigpower, while the other power source (AC-2) can be an uninterruptablepower supply. A router for communications may or may not be necessary.

The redundant sensor inputs of the interface 105 can be protected by theelectrical barriers 114 having fuses to prevent a cascade of electricalfaults. Each controller 122 a-b can be connected to the common, localHMI display 104 a. The fiber optic interface may support remotemonitoring and basic process control via interface applications withremote processing equipment 104 b. The interface electronicsconfiguration is redundant and fault tolerant.

Identical logic can run on each controller 122 a-b. Thus, eachcontroller 122 a-b receives input from the same sources. For example,each controller 122 a-b receives input from the transducers 112 a-ddistributed in the hydraulic power unit (130), receives position sensinginput 107 a-b from the pressure relief valves (64 a-b), and receivesinput from the process sensors 116 a-d of the manifold (60). Each of thevarious pressure transducers and sensors (112 a-d, 116) can be installedin a location and orientation designed to sense line blockage.

Each controller 122 a-b uses a voting scheme for the measurements of theprocess sensors 116 a-d, and each controller 122 a-b processes theinputs with the identical logic. In turn, each controller 122 a-bprovides control signals through outputs 106 a-b to the pressure reliefvalves (64 a-b). Therefore, the controllers 122 a-b should operate thesame and should produce the same processing results. In this way, thecontrollers 122 a-b simultaneously operate the two pressure reliefvalves 64 a-b, yet do their processing independently.

Diagnostics from each individual controller 122 a-b may or may not beincluded in the logic. Such diagnostics may or may not be communicatedbetween the controllers 122 a-b. If diagnostics are shared, eachcontroller 122 a-b can operate according to an appropriate voting schemeto resolve conflicts between any processing results. Alternatively, thecontroller 122 a-b with superior diagnostics may override the other. Infact, one controller 122 a-b may operate on standby, awaiting its needto assume control from the other controller 122 a-b. Preferably,however, both controllers 122 a-b as noted herein simultaneously processthe inputs and provide their independent results, which should beidentical or nearly identical under the circumstances.

During normal operation with no faults, both controllers 122 a-b andtheir associated electronics can operate both pressure relief valves (64a-b) simultaneously, but independently. As shown, each controller 122a-b shares a first control output 106 a to open the first pressurerelief valve (64 a), and each controller 122 a-b shares a second controloutput 106 b to open the second pressure relief valve (64 b). Each valve(64 a-b) is, however, independently capable of the needed open/closefunctions. In the event of a failure of either one of the controllers122 a-b or its associated electronics, the remaining controller 122 a-band associated electronics can continue to operate both pressure reliefvalves 64 a-b.

As shown, each controller 122 a-b also shares the communicationinterface 105 connected to the transducers 112 a-d of the hydrauliccontrol unit (130). The interface 105 includes connections to a firsttransducer 112 a for measuring the pneumatics for the manifold (60) andconnections to other transducers 112 b-d for measuring the hydraulicsfor the manifold (60), as described later. The communication interface105 includes a connection to a level indicator 112 e for receiving anindication of hydraulic level of the hydraulic control unit (130). Inthis way, the transducers 112 a-e provide diagnostics of the hydraulicunit (130).

As shown, each controller 122 a-b also shares communication with thesensors 116, which can be pressure transducers that redundantly measurethe line pressure to detect an overpressure condition requiring pressurerelief by the pressure relief system 100. These pressure transducers 116can have the same or different ranges, alarms, sensitivities, etc. Thecommunication interface 105 also includes a first connection (PRV1 ZT1)to a first position sensor (157) for the first pressure relief valve (64a), and includes a second connection (PRV2 ZT2) to a second positionsensor (157) for the second pressure relief valve (64 b). In general,the position sensors (157) can indicate if the associated valve 64 a-bis fully open.

F. Hydraulic Control Unit

FIG. 6 illustrates a schematic of a hydraulic control unit 130 for thedisclosed pressure relief system (100). As shown in FIG. 6, thehydraulic control unit 130 consists of redundant hydraulic, pneumatic,and electrical components. Field deployment uses bulkhead connections170 for rig air supply 172, sensors connections 112 a-d, and hydraulicconnections 174 a-b. Hydraulics controls consist of dual air drivenpumps 186 a-b, dual accumulators 188 a-b, and hydraulic circuits 180 a-bcross-connected for redundancy. Each half of the duplicated componentsis sized to operate both pressure relief valves 64 a-b simultaneously.

The two hydraulic circuits 180 a-b operate the pressure relief valves 64a-b independently. Each circuit 180 a-b includes a spring-biased (todefault close) solenoid operated directional control valve (DCVs) 192a-b. Each electrically-operated valve (DCVs) 192 a-b in turn energizesfour (4) hydraulically-operated directional control valves (DCVs) 194a-d, 196 a-d. Based on the control of these valves 192 a-b, 194 a-b, 196a-b, each circuit 180 a-b delivers open pressure 174 a and closepressure 174 b for the motive force of the pressure relief valves (64a-b).

To do this, rig air supply 172 for the circuits 180 a-b is split andpasses through filter-regulator-lubricator components 181 a-b topneumatic pumps 186 a-b. Hydraulic fluid from a hydraulic source 182 isdrawn by the pneumatic pumps 186 a-b through suction lines 184 a-b. Fromthe pneumatic pumps 186 a-b, the hydraulics pass components 187 a-b ofpressure relief valves, check valves, and the like. The hydraulics thencombine together in a common hydraulic input 188 and pass connections tothe accumulators 188 a-b. The accumulators 188 a-b can take over inmaintaining the hydraulic pressure should the rig air supply 172 fail orboth of the pumps 180 a-b fail. Moreover, one of the accumulators 188a-b can take over for the other should it fail.

The combined pumped hydraulic input 188 then pass to split controls 190a-b, each having an electrically-driven directional control valve 192a-b. The first electrically-driven valve 192 a operates to open/closethe first of the pressure relief valves (64 a) and receives firstcontrol signals (106 a: FIG. 5) from either of the controllers 122 a-bof the processing control unit (120). The second electrically-drivenvalve 192 b operates to open/close the second of the pressure reliefvalves (64 b) and receives first control signals (106 b: FIG. 5) fromeither of the controllers (122 a-b) of the processing control unit(120).

As noted herein, each electrically-driven valve 192 a-b receives aninput signal from both of the controllers 122 a-b. In this way, an inputsignal to actuate the electrically-driven valves 192 a-b and open thepressure relief valve 64 a-b can be received from one or both of thecontrollers 122 a-b. Because each of the electrically-driven valves 192a-b shares two electrical connections with the controllers 122 a-b, eachconnection needs to be isolated from the other so that a short of oneconnection does not translate to a short of the other. In other words, ashort of the electrical connection of one controller 122 a to theelectrically-driven valve 192 a should not cause a short of theelectrical connection of the other controller 122 b to theelectrically-driven valve 192 a. As will be appreciated, each of theelectrical connections between components of the control unit (120) andthe hydraulic control unit 130 for the various shared sensors, signals,inputs, outputs, and the like are likewise isolated to prevent a shortof one translating to a short of another.

Each electrically-driven valve 192 a-b has a set of fourhydraulically-operated directional control valves (DCVs) 194 a-d, 196a-d, which are stacked as piloted valves with reduced leakage in thehydraulic arrangement. The combined pumped hydraulics pass to both theelectrically-driven valves 192 a-b and also split to pass to the openand close hydraulically-driven valves 194 a-b, 196 a-b. Respectiveoutput from the split controls 190 a-b pass pilot-operated check valves198 a-b before reaching the open connections 174 a and the closeconnections 174 b on the bulkhead 170 for the two pressure relief valves64 a-b.

Looking at the first circuit 180 a, the first electrically-driven valve192 a has a default state, including (3 closed) closing offcommunication of the pumped hydraulics and including (1-2 pass)connecting the pressure inputs (3) of the hydraulically-operated valves194 a-d to the discharge line 185. The first electrically-driven valve192 a has an active state, including (3-2 pass) and including (1 closed)directing the pumped hydraulics to the pressure inputs (3) of thehydraulically-operated valves 194 a-d.

The open hydraulically-driven valve 194 a has a default closed state (2closed, 1 closed) and has an active opened state (2-1 pass) whenhydraulically driven by pressure input (3). The closehydraulically-driven valve 194 b has a default opened state (2-1 pass)and has an active closed state (2 closed, 1 closed) when hydraulicallydriven by pressure input (3) shared with the open hydraulically-drivenvalve 194 a.

The other hydraulically-driven valves 194 c-d control communication fromthe open and close hydraulically-driven valve 194 a-b to the dischargeline 185. These valves 194 c-d share pressure inputs (3) selectivelyconnected by the electrically-driven valves 192 a to the discharge line185 or the combined pumped hydraulics. One of these valves 194 c has adefault state, including (2-closed, 1-closed) preventing communicationof the output from the close valve 194 b to the discharge line 185, andhas an active state, including (1-2 pass) communicating the output fromthe close valve 194 b to the discharge line 185. The other of thesevalves 194 d has a default state, including (1-2 pass) communicating theoutput from the open valve 194 a to the discharge line 185, and anactive state, including (2-closed, 1-closed) preventing communication ofthe output from the open valve 194 a to the discharge line 185.

The electrically-driven valve 192 b and hydraulically-driven valves 196a-d for the second circuit 180 b are similarly configured. Therefore,the above discussion is reincorporated here, applying to the connectionsbetween the electrically-driven valve 192 b and the hydraulically-drivenvalves 196 a-d for the second circuit 180 b.

Instrumentation is included to monitor critical pneumatic and hydraulicfunctions to reveal any hydraulic or pneumatic component or circuitfailure. In particular, the instrumentation includes the transducers 112a-d, which connect via buffers (114) to the processing unit's interface(105: FIG. 5) for the controllers (122 a-b) of the processing controlunit (120). The first transducer 112 a measures the air supply 172 forthe pumps 186 a-b. The second transducer 112 b measures the hydraulicpower unit's pressures for the two circuits 180 a-b. The thirdtransducer 112 c measures the pressure relief valve's pressure for thefirst circuit 180 a, and the fourth transducer 112 d measures thepressure relief valve's pressure for the second circuit 180 b. The levelindicator 112 e measures the level of hydraulic fluid in the hydraulicsource 182.

In the event of failure of any critical hydraulic or pneumatic component(worst case), only one pressure relief valve 64 a-b fails and remainsclosed while the other pressure relief valve 64 a-b continues to operatenormally and relieves line pressure as needed. Preferably then, nosingle point failure in the electrical, hydraulic, or pneumatic controlsof the processing unit (120) and hydraulic control unit (130) preventsoperation of at least one pressure relief valve 64 a-b when needed.

G. Conclusion

The pressure relief system 100 is configured so that no componentfailures would cause one of the pressure relief valves 64 a-b to failopen. Instead, certain component failures cause one of the pressurerelief valves 64 a-b to fail closed. Examples of component failures thatcan cause one pressure relief valve 64 a-b to fail closed (afteropening) include: (a) failures of certain electrical fuses; (b) failuresof one of the directional control valves 192 a-b (DCV1 or DCV2); or (c)failure of one of the pilot operated check valves 198 a-b. An example ofcomponent failures that can cause both pressure relief valves 64 a-b tofail closed (after opening) includes a total loss of power (blackout).

Other component failures may occur that require operations to bestopped. For example, certain component failures may potentially causeone or both the pressure relief valves 64 a-b to fail in place or failopen, at which point operations would be stopped. These componentfailures could include failure of the hydraulically-operated controlvalves 194 a-d, 196 a-d (DCV1A to DCV1D or DCV2A to DCV2D), failure ofanalog inputs, failures of accumulator bleed valves, and the like.

As discussed above, the pressure relief system 100 of the presentdisclosure can be used for the buffer manifold 60 in a managed pressuredrilling system 10. In particular, the equipment protection provided bythe pressure relief system 100 is applied with the pressure reliefvalves 64 a-b at the buffer manifold 60 to protect the riser 20, thechoke manifold 70, the formation, etc. Separate consideration can begiven to overpressure protection of surface equipment for scenarioswhere the source of overpressure is from the standpipe manifold 46, thechoke & kill manifolds 80, or other equipment. Therefore, the teachingsof the present disclosure can be applied to rapid acting pressureprotection for other interconnects of the drilling system 10, such asinterconnects of the standpipe manifold 46, the choke and kill manifold80, and discharge of the mud pumps 42.

Accordingly, the pressure relief system 100 can be used elsewhere in adrilling system 10 and can be used in processes where protection fromoverpressure is desired. As one example, FIG. 1 illustrates where apressure relief system 100′ can used in another location of the drillingsystem 10. Here, the pressure relief system 100′ is used for theoverpressure protection at the discharge of the mud pumps 42. Thedetails of the pressure relief system 100′, including the pressurerelief valves, controllers, sensors, hydraulic circuits, etc., aresimilar to those disclosed above so that the description of thesedetails are incorporated here. Redundant sensors measure the dischargepressure of the mud pumps 42 for overpressure protection so the pressurerelief system 100′ can be opened to relieve overpressure when needed. Asanother example, the disclosed pressure relief system 100′ can be usedfor overpressure protection in the standpipe manifold 46.

The disclosed pressure relief system can be used in other drillingconfigurations and systems. For example, the drilling system can includea flowline from the wellbore. The pressure relieve system can use apressure relief valve and a choke on the flowline from the wellbore. Theflow passes through the pressure relief valve and passes to the chokebefore passing on to further downstream equipment. As disclosed herein,the pressure relief system in this arrangement can relieve overpressureso equipment can be protected, while still being able to be dynamicallyadjusted for the current needs of an operation.

The foregoing description of preferred and other embodiments is notintended to limit or restrict the scope or applicability of theinventive concepts conceived of by the Applicants. It will beappreciated with the benefit of the present disclosure that featuresdescribed above in accordance with any embodiment or aspect of thedisclosed subject matter can be utilized, either alone or incombination, with any other described feature, in any other embodimentor aspect of the disclosed subject matter.

In exchange for disclosing the inventive concepts contained herein, theApplicants desire all patent rights afforded by the appended claims.Therefore, it is intended that the appended claims include allmodifications and alterations to the full extent that they come withinthe scope of the following claims or the equivalents thereof.

What is claimed is:
 1. An assembly for relieving pressure of fluid flowin a drilling system in response to a pressure level measurement of thedrilling system, the assembly comprising: pressure relief valvesdisposed in fluid communication between the fluid flow and at least onedischarge outlet, each of the pressure relief valves operable to openand close fluid communication of the fluid flow with the at least onedischarge outlet; hydraulic circuits being cross-connected to oneanother and being operably connected to the pressure relief valves, thehydraulic circuits providing hydraulic motive force respectively to thepressure relief valves; and controllers operably connected to thehydraulic circuits, each of the controllers receiving the pressure levelmeasurement of the drilling system, both of the controllers in astandard condition simultaneously controlling the hydraulic motive forceprovided in the hydraulic circuits respectively to the pressure reliefvalves to independently open and close the respective pressure reliefvalve in response to the pressure level measurement, in response to afirst failure condition of either one of the controllers, the other oneof the controllers independently controlling the hydraulic motive forceprovided in the hydraulic circuits respectively to the pressure reliefvalves to simultaneously open and close the respective pressure reliefvalves in response to the pressure level measurement.
 2. The assembly ofclaim 1, wherein, in response to a second failure condition of eitherone of the hydraulic circuits, either one of the pressure relief valvesautomatically faults closed regardless of the pressure levelmeasurement.
 3. The assembly of claim 1, comprising a manifold havingone or more flow inlets disposed in fluid communication with an upstreamportion of the drilling system and receiving the fluid flow therefrom,and having one or more flow outlets disposed in fluid communication witha downstream portion of the drilling system and delivering the fluidflow thereto.
 4. The assembly of claim 1, further comprising sensorscommunicatively connected to the controllers and providing readings forthe pressure level measurement of the drilling system.
 5. The assemblyof claim 1, further comprising a plurality of sensors distributed in thehydraulic circuits and measuring a plurality of operational parameters,both of the controllers receiving the operational parameters, either oneof the controllers detecting a second failure condition associated withthe operational parameters from one of the hydraulic circuits andautomatically faulting the respective pressure relief valve closed inresponse to the second failure.
 6. The assembly of claim 5, wherein thehydraulic circuits comprise pumps connected to a pneumatic supply andpumping the hydraulic motive force; and wherein a first of the sensorscomprises a first pressure transducer measuring pressure of thepneumatic supply as one of the operational parameters.
 7. The assemblyof claim 6, wherein the pumps connected to the pneumatic supply pump thehydraulic motive force to a common hydraulic input for the hydrauliccircuits.
 8. The assembly of claim 7, wherein a second of the sensorscomprises a second pressure transducer measuring the common hydraulicinput as one of the operational parameters.
 9. The assembly of claim 7,comprising one or more accumulators connected to the common hydraulicinput.
 10. The assembly of claim 6, wherein the hydraulic circuitsprovide the hydraulic motive force in the event of failure of either oneof the pumps.
 11. The assembly of claim 5, wherein a third of thesensors comprises a third pressure transducer measuring pressure of thehydraulic motive force to a first of the pressure relief valves as oneof the operational parameters, either one of the controllers detectingthe measured pressure below a first threshold as the second failurecondition and automatically faulting the first pressure relief valveclosed in response thereto.
 12. The assembly of claim 11, wherein afourth of the sensors comprises a fourth pressure transducer measuringpressure of the hydraulic motive force to a second of the pressurerelief valves as one of the operational parameters, either one of thecontrollers detecting the measured pressure below a second threshold asthe second failure condition and automatically faulting the secondpressure relief valve closed in response thereto.
 13. The assembly ofclaim 1, wherein each of the controllers is communicatively connected toa position sensor of each of the pressure relief valves, either one ofthe controllers detecting either one of the pressure relief valvesfailing to open as the second failure condition.
 14. The assembly ofclaim 1, wherein each of the hydraulic circuits comprises anelectrically-driven directional control valve having a default no-flowstate and an active flow state, both of the electrically-drivendirectional control valves being connected to a common hydraulic input.15. The assembly of claim 14, Wherein each of the controllers iscommunicatively connected to the electrically-driven directional controlvalves of both of the hydraulic circuits to provide a control signalthereto; wherein in the second failure condition, either of thecontrollers is configured to automatically fault a respective one of thepressure relief valves closed in response to a failure of the respectiveelectrically-driven directional control valve; and/or wherein thehydraulic motive force is provided in the open circuit of a first of thehydraulic circuits in the event of a failure of the electrically-drivendirectional control valve in a second of the hydraulic circuits, thepressure relief valve of the second hydraulic circuit defaulting to aclosed condition.
 16. The assembly of claim 14, wherein each of thehydraulic circuits comprises a pair of open and closehydraulically-driven directional control valves connected to the commonhydraulic input, the open hydraulically-driven directional control valvehaving a default closed state and an active opened state, the closehydraulically-driven directional control valve having a default openedstate and an active closed state, the active opened state providing anopen output of the hydraulic motive force to open the respectivepressure relief valve, the default opened state providing a close outputof the hydraulic motive force to close the respective pressure reliefvalve, the open and close hydraulically-driven directional controlvalves each having the respective default state in response to theelectrically-driven directional control valve having the default no-flowstate and each having the respective active state in response to theelectrically-driven directional control valve having the active flowstate.
 17. The assembly of claim 16, wherein each of the hydrauliccircuits comprises a pair of discharge hydraulically-driven directionalcontrol valves, a first of discharge hydraulically-driven directionalcontrol valves connected to the open output and having a default openstate and an active close state, the default open state communicatingwith a discharge, a second of the discharge hydraulically-drivendirectional control valves connected to the close output of the closehydraulically-driven directional control valve and having a defaultclosed state and an active opened state, the active opened statecommunicating with the discharge, the discharge hydraulically-drivendirectional control valves each having the respective default state inresponse to the electrically-driven directional control valve having thedefault no-flow state and each having the respective active state inresponse to the electrically-driven directional control valve having theactive flow state.
 18. The assembly of claim 16, wherein each closeoutput comprises a pilot-operated check valve piloted by the respectiveopen output.
 19. An assembly used with a buffer manifold for relievingpressure of fluid flow in a drilling system, the drilling system havinga pneumatic supply, the buffer manifold having one or more flow inlets,one or more flow outlets, and first and second pressure relief valves,the one or more flow inlets disposed in fluid communication with anupstream portion the drilling system and receiving the fluid flowtherefrom, the one or more flow outlets disposed in fluid communicationwith a downstream portion the drilling system and delivering the fluidflow thereto, the first and second pressure relief valves disposed influid communication between the one or more flow inlets and the one ormore flow outlets and disposed in fluid communication with at least onedischarge outlet, each of the first and second pressure relief valvesoperable to open and close fluid communication with the at least onedischarge outlet, wherein the control assembly comprises: a hydraulicarrangement operably connected to the first and second pressure reliefvalves and connected to the pneumatic supply, the hydraulic arrangementpowered by the pneumatic supply and providing hydraulic motive force intwo hydraulic circuits respectively to the first and second pressurerelief valves, the two hydraulic circuits being cross-connected to oneanother; a plurality of sensors distributed in the hydraulic arrangementand measuring a plurality of operational parameters of the hydraulicarrangement; and a pair of controllers operably connected to thehydraulic arrangement, each of the controllers receiving the operationalparameters from the sensors and receiving a pressure level measurementof the drilling system, both of the controllers controlling thehydraulic motive force provided in the two hydraulic circuitsrespectively to the first and second pressure relief valves to open andclose the first and second pressure relief valves in response to thepressure level measurement.
 20. A method of controlling fluid flow in adrilling system, the method comprising: receiving the fluid flow from anupstream portion of the drilling system at one or more flow inlets of amanifold assembly; in response to a first pressure level measurement ofthe drilling system, flowing the fluid flow out one or more flow outletsof the manifold assembly to a first downstream portion of the drillingsystem in response thereto; in response to a second pressure levelmeasurement of the drilling system, flowing the fluid flow out at leastone discharge outlet of the manifold assembly to a second downstreamportion of the drilling system, instead of out the one or more flowoutlets, by simultaneously controlling, with controllers, hydraulicmotive force provided in hydraulic circuits respectively to pressurerelief valves to independently open the respective pressure reliefvalve; in response to a first failure condition of either one of thecontrollers, independently controlling, with the other one of thecontrollers, the hydraulic motive force provided in the hydrauliccircuits respectively to the pressure relief valves to simultaneouslyopen and close the respective pressure relief valves in response to thefirst and second pressure level measurements; and in response to asecond failure condition of either one of the hydraulic circuits,automatically faulting either one of the pressure relief valves closedregardless of the first and second pressure level measurements.